>We’ve had several influential folks from the researcher community join our security teams as Microsoft employees I can confirm they had a (semi?) official pro

>We’ve had several influential folks from the researcher community join our security teams as Microsoft employees I can confirm they had a (semi?) official program to do this as far back as 2006, as I was actually doing penetration testing as a hobby in high school a couple years before this article was written. They flew myself and a few other researchers out for retreats, put us up in nice hotels, took us out to fancy dinners, offered us internships, sent me an ipod video for my birthday at a time when they were really pushing the Zune, and at one point they even organized a huge paintball retreat for myself and some of the employees. The whole thing really put a very human face on the "corporate" persona we had always associated with Microsoft. I think their strategy was more focused on grooming researchers to become permanent employees (which a few of them did, including Skylined, the guy that developed the Heapspray technique [1], who I shared an office with - super nice guy) or at the very least building loyalty to encourage responsible disclosure. They were also very interested in hearing how us researchers could be persuaded to continue disclosing responsibly, as a few of us were known to wear hats that weren't always white. >I think Microsoft might be unique in offering a huge bonus for core platform exploitation I'm happy to see them taking such a progressive approach considering a single critical security flaw can rake in tens of thousands of dollars on the black market. [1] http://en.wikipedia.org/wiki/Heap_spraying http://en.wikipedia.org/wiki/Heap_spraying